{"id":11415,"date":"2019-08-20T10:31:23","date_gmt":"2019-08-20T14:31:23","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11415"},"modified":"2020-12-01T12:26:57","modified_gmt":"2020-12-01T17:26:57","slug":"the-top-9-cyber-security-threats-that-will-ruin-your-day","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/the-top-9-cyber-security-threats-that-will-ruin-your-day\/","title":{"rendered":"The Top 9 Cyber Security Threats That Will Ruin Your Day"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">2019\u2019s biggest cyber security threats are and what you can do to avoid them<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Like a sniper, the most dangerous cyber security threats\nare the ones you never see coming. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Even with firewalls, antivirus solutions, and cyber\nsecurity awareness training for your employees, cybercriminals still manage to\nexploit any vulnerabilities they can find. This could be because they exploit\nattack vectors that are known to your organization (but remain unaddressed for\nsome reason) or because they\u2019ve discovered vulnerabilities that are not yet\nknown to you (what are known as zero-day exploits). &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Either way, you still lose. Cyber attacks are not a matter of \u201cif,\u201d but \u201cwhen\u201d they will occur. Unless you somehow gain omniscience (if that happens, be sure to reach out and we can split the cost of a lotto ticket), there\u2019s really no way for you to know every single vulnerability that exists on your network or within your organization. After all, security risks come in all shapes, sizes, attack vectors, and levels of potency in the digital world. And, considering that threats to cyber security are continually changing and adapting, it\u2019s a challenge to keep up with them all. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, what can you do? You can take the time to learn about\nas many cyber security threats as possible and work to identify and address as\nmany holes in your defenses that you possibly can. Granted, we understand\nthat\u2019s no small undertaking. But, see, that\u2019s why we\u2019re here!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While we\u2019d love to provide you with a top 10 cyber\nsecurity threats list, we\u2019re tuckered out after just writing nine. So, we\u2019ll\ncover nine of the biggest cyber security threats that exist in 2019, provide\nsome recent examples of each, and identify some of the ways you can protect\nyour organization (regardless of its size). &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12753\"><\/span>\n\n\n\n<h2 class=\"wp-block-heading\">The Top 9 Cyber Security Threats and Risks of 2019<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The term \u201ccyber security threats\u201d is pretty nebulous \u2014 it\ncan mean many different things depending on whom you ask. For some, threats to\ncyber security are limited to those that come through virtual attack vectors\nsuch as malware, <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, as you\u2019ll discover, cyber threats are\ncontinuously changing. SophosLabs\u2019 <a href=\"https:\/\/www.sophos.com\/en-us\/medialibrary\/PDFs\/technical-papers\/sophoslabs-2019-threat-report.pdf\">2019\nThreat Report<\/a> indicates that: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u201cThe threat landscape is undoubtedly evolving; less skilled cybercriminals are being forced out of business, the fittest among them step up their game to survive and we\u2019ll eventually be left with fewer, but smarter and stronger, adversaries. These new cybercriminals are effectively a cross-breed of the once esoteric, targeted attacker, and the pedestrian purveyor of off-the-shelf malware, using manual hacking techniques not for espionage or sabotage, but to maintain their dishonorable income streams.\u201d<\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">We\u2019ve narrowed down our list of the top nine cyber\nsecurity threats: <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 1: Human Nature<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"243\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/human-nature-300x243.png\" alt=\"\" class=\"wp-image-11422\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/human-nature-300x243.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/human-nature-768x621.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/human-nature-1024x829.png 1024w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Whether with intent or without malice, people are the\nbiggest threats to cyber security. These vulnerabilities come from employees,\nvendors, or anyone else who has access to your network or IT-related systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On one hand, a cyber attack or data breach can occur simply because of human error or a lack of cyber security awareness \u2014 such as using easy-to-guess passwords or falling for phishing emails. They may simply have a moment of forgetfulness or may be tricked by an attacker\u2019s effective targeted social engineering attack. Hackers frequently use social engineering tactics \u2013 akin to \u201chacking without code\u201d because they use other tactics to get information \u2013 to get their victims to either provide the information they need or get them to engage with malicious content (such as malicious URLs). We\u2019ll speak more to that a bit later. Right now, we\u2019re focusing on the other side of the coin \u2014 <em>intentional<\/em> threats to cyber security. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Employees (and former employees) can be significant cyber\nsecurity threats when they think they have something to gain through their\nmalicious actions \u2014 perhaps they want to profit by selling or using the data\nthey steal, or they may want to get revenge against an existing or former\nemployer for some perceived injustice. So, they may install malware, download\ndata, or perform other dire actions. But rogue employees are not the only\nthreat \u2013 employees of vendors can also pose a potential risk. We\u2019ll speak more\non that momentarily.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Whatever the reason, whomever is responsible, the results\nare the same: Data is stolen, your customers are compromised, and your\ncompany\u2019s reputation takes a major hit. It\u2019s a lose-lose situation for everyone\nexcept the perpetrator \u2014 one that likely could have been avoided by operating\nunder the assumption that people are your biggest risk. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">A Recent Example of a Vendor\u2019s (Former) Employee Gone Rogue<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.cnn.com\/2019\/07\/29\/business\/capital-one-data-breach\/index.html\">Capital\nOne recently made headlines<\/a> when more than 100 million customers\u2019\naccounts were compromised in a data breach \u2014 but it wasn\u2019t a random hacker or\neven a CO employee. As it turns out, Capital One used Amazon Web Services (AWS)\nfor their cloud hosting. The hacker, a former AWS employee, decided to exploit a\nmisconfigured web application firewall to gain access to: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u201c140,000 Social Security numbers, 1 million Canadian Social Insurance numbers and 80,000 bank account numbers, in addition to an undisclosed number of people&#8217;s names, addresses, credit scores, credit limits, balances, and other information, <\/em><a href=\"https:\/\/www.capitalone.com\/facts2019\/\"><em>according to the bank<\/em><\/a><em>&nbsp;and the US Department of Justice.\u201d<\/em> <\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">As a\nresult, Capital One expects to face $100-150 million in costs related to the\nhack, including customer notifications, credit monitoring, tech costs, and\nlegal support due to the hack. This is in addition to any potential company\nstock value losses.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">In\naddition to keeping strong firewalls and antivirus solutions in place,\ncompanies should use the services of an in-house or third-party cyber security\noperations center (CSOC) to stave off these types of cyber security threats for\nboth their overall organizational cyber security as well as for their website.\nThe benefit of this is that these individuals are dedicated to the monitoring\nand analysis of logs for your website, applications, systems to intervene at any sign of a\nthreat and to swiftly remediate the threat. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An example\nof such a comprehensive solution (in this case, designed for small business\nwebsites) is <a href=\"https:\/\/www.thesslstore.com\/comodo\/cwatch-web.aspx\">CWatch Web<\/a> from Comodo Cyber Security, an all-in-one managed\nsecurity-as-a-service (SaaS) solution. Not only does it provide you with\n24\/7\/365 access to cyber security experts, but it also includes: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Access to Comodo CA\u2019s fully secure global content delivery\nnetwork (CDN), <\/li><li>A web application firewall (WAF), and <\/li><li>Security information &amp; event management (SIEM). <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Furthermore, limit employee access to sensitive systems using access\nmanagement policies and procedures. Create and maintain a list of access to\nensure that only the people who need access to your company\u2019s databases or\nother systems have access. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 2: Various Forms of Malware<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Malware-300x300.png\" alt=\"\" class=\"wp-image-11351\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Malware-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Malware.png 552w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-malware-types-of-malware-how-they-work\/\">Malware<\/a> is a truly insidious threat. It can be distributed through multiple delivery methods and, in some cases, is a master of disguises. Some types of malware are known as adaptive malware (such as <a href=\"https:\/\/www.thesslstore.com\/blog\/polymorphic-malware-and-metamorphic-malware-what-you-need-to-know\/\">polymorphic or metamorphic malware<\/a>) and can change their very \u201cgenetic\u201d makeup, their coding. Some forms of metamorphic malware can change themselves entirely with each new iteration \u2014 in some cases, they can do it faster than you can say \u201cwell, this sucks.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As we mentioned in another <a href=\"https:\/\/www.thesslstore.com\/blog\/new-malware-the-landscape-of-new-evolving-cyber-threats-in-2019\/\">recent\narticle on malware<\/a>, Microsoft identifies malware cyber security threats pretty\ngenerically: \u201cMalware is the overarching name for applications and other code,\ni.e. software, that Microsoft classifies more granularly as <em>malicious\nsoftware<\/em> or <em>unwanted software<\/em>.\u201d This categorization includes (but\ncertainly is not limited to) malicious software such as backdoors, downloaders,\ntrojans, worms, and macro viruses. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">The Top 10 Types of Malware<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">So, what are considered the biggest cybersecurity threats\nin terms of malware? The <a href=\"https:\/\/www.cisecurity.org\/cybersecurity-threats\/\">Center for Internet\nSecurity<\/a> (CIS) reports that the top 10 malware in July 2019 were:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Emotet<\/li><li>Kovter<\/li><li>ZeuS<\/li><li>NanoCore<\/li><li>Cerber<\/li><li>Gh0st<\/li><li>CoinMiner<\/li><li>Trickbot<\/li><li>WannaCry<\/li><li>Xtrat<\/li><\/ol>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">There are\nmany things you can do to prevent malware-based cyberattacks:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Use reputable antivirus and anti-malware solutions, email\nspam filters, and endpoint security measures.<\/li><li>Ensure that your cyber security updates and patches are all\nup to date.<\/li><li>Require your employees to undergo regular cyber security\nawareness training to teach them how to avoid suspicious websites and to not\nengage with suspicious emails (more on that momentarily).<\/li><li>Limit user access and application privileges.<\/li><li>The list goes on and on. <\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 3: Different Types of Phishing Attacks\nand Social Engineering <\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"230\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Phishing-LinkedIn-230x300.png\" alt=\"\" class=\"wp-image-11378\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Phishing-LinkedIn-230x300.png 230w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Phishing-LinkedIn.png 444w\" sizes=\"auto, (max-width: 230px) 100vw, 230px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">No matter whether you\u2019re a small business or a Fortune\n500 enterprise, phishing is a very real \u2014 and very costly \u2014 cyber security threat.\nIn its <a href=\"https:\/\/www.riskiq.com\/infographic\/evil-internet-minute-2019\/\">Evil\nInternet Minute<\/a> infographic, RiskIQ shares that <strong>$17,700 is lost every\nminute due to phishing attacks<\/strong>. That\u2019s $9,303,120,000 per year based on a\nregular calendar year (525,600 minutes), or $9,328,608, 000 for a leap year\n(527,040 minutes). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But what is phishing? In a nutshell, phishing is a\nfraudulent attempt to elicit sensitive information from a victim in order to\nperform some type of action (gain access to a network or accounts, gain access\nto data, get the victim to perform an action such as a wire transfer, etc.). <a href=\"https:\/\/www.thesslstore.com\/blog\/10-types-of-phishing-attacks-and-phishing-scams\/\">Phishing<\/a>\ncomes in many forms:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>General phishing<\/li><li>Spear phishing <\/li><li>CEO fraud<\/li><li>Smishing<\/li><li>Vishing&nbsp; <\/li><li>Clone phishing<\/li><li>Domain spoofing<\/li><li>URL phishing<\/li><li>Watering hole phishing<\/li><li>Evil twin phishing<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Phishing activities frequently involve the use of social\nengineering tactics. They can use domain spoofing or phone number spoofing to\nmake their communications appear more legitimate. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a quick example of a social engineering hack, check\nout this video by Fusion.net. It shows how easily a hacker gains access to a\njournalist\u2019s cell phone account using social engineering tactics and phone\nnumber spoofing: <\/p>\n\n\n\n<figure class=\"wp-block-embed-youtube wp-block-embed is-type-video is-provider-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"This is how hackers hack you using simple social engineering\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/lc7scxvKQOo?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">Examples of Major Successful Phishing Attacks<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">These types\nof cyber security threats are prolific and can be exceedingly costly. Google\nand Facebook together lost more than $100 million to a cybercriminal whose\nphishing attack spoofed a technology vendor. Crelan Bank in Belgium also lost more\nthan $75 million to cybercriminals and their convincing phishing tactics. We\u2019ve\nwritten about <a href=\"https:\/\/www.thesslstore.com\/blog\/the-dirty-dozen-the-12-most-costly-phishing-attack-examples\/\">several other major phishing attack victims<\/a> if you\u2019d like to read about other\nexamples. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">There are\nseveral things that you can do to ward off cyber security threats:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Implement cyber security awareness training for every\nemployee across the board.<\/li><li>Emphasize the importance of phishing reporting.<\/li><li>Run random phishing simulations.<\/li><li>Push HTTPS on your website to create secure, encrypted\nconnections.<\/li><li>Institute access management policies and procedures.<\/li><li>Use reliable email and spam filters. <\/li><li>Require two-factor authentication.<\/li><li>Use email encryption and email signing certificates. <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The first\nway to reduce the impact of cyber security threats is to implement cyber\nsecurity awareness training and make it mandatory for <em>every<\/em> employee.\nRegardless of whether they\u2019re an intern, the CEO, or anyone in between, if your\nemployees have access to any company device or network, they need to know how\nto use it safely and securely. Some of the biggest phishing attacks involved\n\u201cwhaling,\u201d a form of phishing that targets CEOs, CFOs, or other executives. Erich\nKron, security awareness advocate at <a href=\"https:\/\/www.knowbe4.com\/\">KnowBe4<\/a>, says that\nthis type of training should be offered throughout the year and not just once\nper year for it to be most effective. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, Kron\nsays that phishing reporting is essential for businesses. \u201cProvide a way to\nreport the suspected phishing emails so your team is aware of campaigns\ntargeting your organization and can tune email\/spam filters to protect other\nemployees against the specific campaigns.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Third, run\nrandom phishing simulations. This practice can help you to determine how well\nthe cyber awareness training is being implemented and identify potential areas\nto focus on in future trainings. Kron shares that the frequency of the\nsimulations is important. \u201cWe have found that users need to have simulated\nphishing attacks at least once per month for the best results.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fourth, use HTTPS for your website by installing SSL\/TLS certificates. An SSL certificate helps to facilitate the handshake that is required to create a secure, encrypted connection between your users\u2019 browsers and your web server. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fifth, setting\nup proper access management is essential. This helps to ensure that no one has\naccess to systems or data that their jobs don\u2019t require access to. This is not\na set-it-and-forget-it thing, though \u2014 you\u2019ll need to continually maintain the\nlist to ensure it remains up to date. Policies and procedures need to be\nimplemented to ensure that when an employee leaves or is fired, that their\naccess is immediately terminated to limit risk and potential exposure. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sixth, use effective and reliable phishing and spam\nfilters for your organization\u2019s email accounts. There are third-party service\nproviders on the market that use various methods such as metadata analysis to\ndifferentiate phish or other malicious emails from valid messages. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Seventh, implement two-factor authentication (2FA) for\nemployees. Even if an employee\u2019s credentials become compromised, it can still\nhelp to prevent a cybercriminal from accessing your network or data by\nrequiring additional user authentication. While 2FA on its own is not necessarily\ninfallible, it is another link in the chainmail of your cyber security armor. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Lastly, if you handle any type of sensitive information\nvia email, it\u2019s vital that you secure that information as much as possible.\nThis includes both in-transit and at-rest data protection through the use of\nthe secure\/multipurpose internet mail extension, or what\u2019s known as <a href=\"https:\/\/www.thesslstore.com\/blog\/what-you-need-to-know-about-s-mime\/\">S\/MIME<\/a>.\nAn email signing and encryption certificate uses this email signing protocol and\npublic\/private keys to:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Encrypt data at rest and in transit so that it\u2019s\nsecure, and <\/li><li>Sign the email with a verified digital signature\nso your recipient can confirm you actually sent it. <\/li><\/ul>\n\n\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 4: Formjacking<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Formjacking-300x300.png\" alt=\"\" class=\"wp-image-11421\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Formjacking-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Formjacking.png 713w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Formjacking. Much like how it sounds, this type of cyber\nsecurity threat involves a cybercriminal taking over forms on websites by\nexploiting their security weaknesses. In many cases, cybercriminals use lines\nof malicious JavaScript code on the checkout page forms of eCommerce websites\nto steal their customers\u2019 financial and payment information such as credit card\nnumbers. The goal is to skim and harvest any valuable data that end users\nsubmit via the forms. Sometimes, cybercriminals will use third-party\napplications such as chats and surveys as their attack vectors. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Symantec\u2019s <a href=\"https:\/\/www.symantec.com\/en\/sg\/security-center\/threat-report\">2019 Internet\nSecurity Threat Report<\/a> shows that formjacking was on the rise in 2018. The\ninternet security company reported an average of 4,800 websites were\ncompromised with formjacking code each month. The report also stated that 3.7\nmillion formjacking attacks were blocked on endpoints.&nbsp; <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Notable Examples of Formjacking Attacks <\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">For examples of recent successful formjacking attacks,\nlook no further than the <a href=\"https:\/\/www.infosecurity-magazine.com\/opinions\/security-formjacking-1-1-1\/\">British\nAirways and Ticketmaster attacks<\/a> that were believed to be perpetrated by\nmalicious actors known as Magecart. The British Airways attack resulted in more\nthan 380,000 credit cards being stolen at an estimated loss of $17 million.\nThis is in addition to the record <a href=\"https:\/\/www.bbc.com\/news\/business-48905907\">\u00a3183 million fine<\/a> that was\nlevied against the company due to its lack of General Data Protection\nRegulation (GDPR) compliance. GDPR allows fines of up to 4% of a company\u2019s\nannual turnover for noncompliance. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Some of the ways that you can prevent formjacking\ninclude: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Running vulnerability scanning and penetration\ntesting \u2014 this will help you to identify any vulnerabilities or weaknesses in\nyour cyber security defenses. <\/li><li>Monitoring outbound traffic on your site \u2014 this\nwill help you be aware of any traffic from your site to another location.<\/li><li>Using subresource integrity (SRI) tags \u2014 this\npractice helps you to ensure files used by web applications and documents don\u2019t\ncontain unexpected, manipulated content using hashing.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 5: Inadequate Patch Management <\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Patching-300x300.png\" alt=\"\" class=\"wp-image-11420\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Patching-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Patching.png 748w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The purpose of a patch is to cover a hole of some kind.\nManufacturers release patches all the time to address vulnerabilities in their\noperating systems, software, and other technologies. They\u2019re essential to the\nsecurity of your business \u2014 yet, frequently, patching largely gets ignored both\nby users and IT security teams simply because they have so many other\nresponsibilities to manage. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Why is poor patch management such a big issue? Imagine you\nown a kayak and decide to spend a day out on the ocean (we live in Florida \u2014\nthis isn\u2019t an unusual notion for us). You load up the kayak and drive to the\nbeach, put the kayak in the water and start to paddle out. After a little\nwhile, you notice that your kayak has a very small leak but choose to ignore it\nand keep paddling. After leaving the small hole unaddressed for a while, that\nslow leak grows larger. Your kayak\u2019s compartment soon begins to fill with\nwater, causing your kayak to start sinking. Eventually, you\u2019ll find yourself\nhaving to swim back to shore. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This analogy is much like inadequate patch management,\nwhich leaves gaping holes in your IT security infrastructure. Ideally, patching\nshould be implemented as soon as a vulnerability is known as these holes\nbecause they: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>leave your organization at risk of cyberattacks,<\/li><li>lead to needing remediation, which can lead to\ndowntime,<\/li><li>cause reputational harm, and<\/li><li>make you noncompliant with many industry and\nregulatory cyber security standards. <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Unfortunately, far too many companies aren\u2019t patching\nlike they should be. This may be in part because not all businesses have the\nresources to expedite that process in house, so they roll out patches when they\ncan, or they may need (but think they can\u2019t afford) the services of a\nthird-party service provider. Regardless of the reason, a lot of technology remains\nunpatched, which leaves businesses and their data vulnerable to even the most\nbasic cyber security threats. For example, <a href=\"https:\/\/www.helpnetsecurity.com\/2019\/06\/12\/avast-patch-management-service\/\">research<\/a>\nfrom Avast, a digital security products company, shows that of the 500,000\ndevices that they analyzed, only 304 \u2014 less than 1% \u2014 were 100% patched. This\nis simply unacceptable. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">An Example of Patch Management Issues<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">EternalBlue. It\u2019s a name that virtually everyone in the\ninfosec industry knows as an exploit that was allegedly developed by the\nNational Security Agency (NSA). It\u2019s an exploit of a Microsoft vulnerability\nthat led to multiple worldwide attacks, including the spread of Petya and the WannaCry\nransomware. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although Microsoft had released patches for EternalBlue well\nbeyond the 2017 WannaCry attacks began, many organizations remained vulnerable\nbecause they either didn\u2019t apply the patches or because they were operating on\nold systems that were past their supported end-of-life period. This patching\nissue led to massive issues for businesses across a variety of industries,\nincluding the <a href=\"https:\/\/www.telegraph.co.uk\/technology\/2018\/10\/11\/wannacry-cyber-attack-cost-nhs-92m-19000-appointments-cancelled\/\">National\nHealthcare System<\/a> (NHS) in the United Kingdom. Thousands of appointments\nand surgeries were cancelled, the incident cost NHS more than \u00a3100\nmillion. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Even now, two years after the WannaCry attacks, <a href=\"https:\/\/healthitsecurity.com\/news\/despite-microsoft-patch-attacks-using-wannacry-exploit-on-the-rise\">EternalBlue\ncontinues to impact systems<\/a> around the world.&nbsp; <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Make patch management a priority. It\u2019s not optional;\neffective patch management is essential to the livelihood of your business and\nthe security of your customers\u2019 data. Developing and implementing effective\npatch management policies and procedures helps to reduce the attack surface of\nyour organization by closing up the holes in security that can allow data to be\nstolen. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Automating this process would also be highly beneficial.\nPatching these vulnerabilities in real time through automation makes your cyber\nsecurity more effective and is also one less task for your team to have to\nperform manually. It\u2019s a win-win for everyone \u2014 except, of course, the hackers\nwho want to take advantage of unpatched vulnerabilities. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No 6: Outdated Hardware and Software<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Outdated-300x300.png\" alt=\"\" class=\"wp-image-11419\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Outdated-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Outdated.png 680w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Wondering why we\u2019ve broken this section out separately?\nWhile it\u2019s true that all patches are updates, it\u2019s equally true that not all\nupdates are patches. That\u2019s why we\u2019ve broken them out into two separate\nsections. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Keeping your hardware and software assets up to date is\nvital to the security of your organization\u2019s network, servers, devices, data,\nand customers. If you\u2019re using out-of-date technologies, your security defenses\nare no better than using a wall made of swiss cheese to keep out enemies. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine that you\u2019re a solider on a battlefield. You\u2019re\narmed with a sword, a knife, a crossbow, some leather armor. Your enemies, on\nthe other hand, are armed with Kevlar body armor, M4 rifles, and an assortment\nof other modern weapons and vehicles. Who do you think will be victorious? <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same concept can be applied to your cyber security\ndefenses. If your business is operating using outdated operating systems,\nsecurity software, and other applications or tools, then you\u2019re not going to be\nable to stave off attacks from a well-armed cybercriminal. After all, they\u2019ve\ngot the technology, tools, and know-how to plough through such flimsy defenses\nwhile evading detection. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Examples of Outdated Systems <\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Look around the internet \u2014 examples of data breaches and\nother cyber security incidents that resulted from outdated or unpatched\ntechnologies are <em>everywhere<\/em>. Okay, if you still want us to provide a few\nexamples, then look no further than the WannaCry and Petya attacks we mentioned\nearlier, as well as <a href=\"https:\/\/www.wired.com\/story\/equifax-breach-no-excuse\/\">Equifax\u2019s 2017\ndata breach<\/a> that involved a <a href=\"https:\/\/www.forbes.com\/sites\/thomasbrewster\/2017\/09\/14\/equifax-hack-the-result-of-patched-vulnerability\/\">patchable\nvulnerability<\/a>.&nbsp; &nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Unsupported and outdated software are hackers\u2019 best\nfriends, so be sure to put your best foot forward by keeping your systems and\nsoftware up to date. &nbsp;When a manufacturer\nreleases an update or patch, apply it as soon as possible. Don\u2019t wait. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pushing the latest updates keeps your operating system,\napplications, and other assets up to date strengthens your defenses and helping\nyour data to remain secure and out of the reach of cybercriminals. Develop\ndevice management policies for your organization and follow industry device\nmanagement best practices. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 7: Internet of Things Insecurities<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/IoT-300x300.png\" alt=\"\" class=\"wp-image-11418\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/IoT-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/IoT.png 680w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Internet of Things (IoT) technologies are marvels to\nbehold \u2014 and they\u2019re <em>everywhere<\/em>. The Internet of Things connects and\nnetworks devices across the world. Examples of IoT technologies in the\nworkplace include everything from smart thermostats and videoconferencing\ntechnologies to warehouse stock monitors and even \u201csmart\u201d vending machines that\ncan order their own refills. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IoT is popular, and its popularity continues to grow. Gartner\nreports that they anticipate more than <a href=\"https:\/\/www.thesslstore.com\/blog\/80-eye-opening-cyber-security-statistics-for-2019\/\"><em>20.4\nbillion<\/em> IoT devices will exist by 2020<\/a>. But why are they becoming so\npopular for businesses and private users so quickly? In part, it\u2019s because IoT\ntechnologies, a combination of sensors, software, devices, and networks, <a href=\"https:\/\/www.zdnet.com\/article\/iot-in-the-office-everything-you-need-to-know-about-the-internet-of-things-in-the-office\/\">make\nhomes and workplaces more \u201cintelligent.\u201d<\/a> They help people and companies\naround the world make environments more comfortable, and certain operational\nfunctions more convenient and efficient through automation. Makes sense, right?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But with all of this enhanced connectivity and\nconvenience come security risks \u2014 big ones. It\u2019s no secret that IoT\ntechnologies are a gaping hole of need when it comes to cyber security. After\nall, the very things that make IoT so convenient is also what also makes it\nvulnerable. <em><\/em><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">OWASP Top 10 IoT Vulnerabilities<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Many of the reasons that IoT insecurities are some of the\nbiggest cyber security threats to businesses and users are covered by OWASP (the\nOpen Web Application Security Project) in their annual list of the <a href=\"https:\/\/www.owasp.org\/images\/1\/1c\/OWASP-IoT-Top-10-2018-final.pdf\">Top 10\nIoT Vulnerabilities<\/a>. Their 2018 list (the most recent) includes the\nfollowing vulnerabilities:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Weak, Guessable, or Hard-Coded Passwords<\/li><li>Insecure Network Services<\/li><li>Insecure Ecosystem Interfaces<\/li><li>Lack of Secure Update Mechanisms<\/li><li>Use of Insecure or Outdated Components<\/li><li>Insufficient Privacy Protection<\/li><li>Insecure Data Transfer and Storage<\/li><li>Lack of Device Management<\/li><li>Insecure Default Settings<\/li><li>Lack of Physical Hardening<\/li><\/ol>\n\n\n\n<h4 class=\"wp-block-heading\">Examples of Cyber Attacks That Resulted from IoT-Related Cyber Security\nThreats <\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Geez. Where do we start? IoT cyber security threats\naffect companies and organizations across just about every industry. An unnamed\n<a href=\"https:\/\/www.businessinsider.com\/hackers-stole-a-casinos-database-through-a-thermometer-in-the-lobby-fish-tank-2018-4\">casino\u2019s\nhigh-roller database<\/a> was compromised when hackers accessed the casino\u2019s\nnetwork using the smart thermometer of the aquarium in its lobby. A British\nbank was hacked via its CCTV cameras. Botnets \u2014 entire networks of connected\nIoT devices \u2014 have been used to launch major distributed denial of service (DDoS)\nattacks. One such example, the Mirai botnet, <a href=\"https:\/\/www.csoonline.com\/article\/3258748\/the-mirai-botnet-explained-how-teen-scammers-and-cctv-cameras-almost-brought-down-the-internet.html\">nearly\nbrought down the internet<\/a> along the entire eastern seaboard of the U.S. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The list goes on and on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While we don\u2019t condone the actions of these\ncybercriminals \u2014 yes, we need to state that to cover our butts \u2014 we can\nappreciate their demonstrable ingenuity and creativity. After all, who\ntypically thinks of pulling off a casino data heist through an aquarium? <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A hacker, that\u2019s who. That\u2019s why you need to up your ante\nand strengthen your IoT cyber security defense to prevent cyber security\nthreats from getting through. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Securing your IoT is about more than just securing your\ndevices \u2014 it\u2019s also about protecting data and privacy. As such, look beyond\njust IoT device security solutions \u2014 consider everything from the application\nand network to the IoT ecosystem as a whole \u2014 to identify any vulnerabilities\nand potential liabilities. Part of this is about creating and implementing\norganizational mitigation policies and processes that will address IoT device\nlifecycle challenges concerning cyber security and privacy. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You also can use <a href=\"https:\/\/www.thesslstore.com\/enterprise\/iot-security.aspx\">IoT digital\nsecurity certificates<\/a> as part of your PKI infrastructure to facilitate\nencrypted connections. Like other x.509 digital security certificates, IoT\ndevice certificates verify identity to ensure only trusted devices can connect\nand any messages or data transferred are secure and encrypted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look, regardless of how you choose to do it, just make\nsure your IoT is secure. While we get that accomplishing this task is not an\neasy undertaking \u2014 after all, effective cyber security requires considerable time\nand resources without the use of automation \u2014 securing your IoT is not optional.\nIt\u2019s also significantly less time-consuming and costly than dealing with the\naftermath of a cybersecurity attack or data breach.&nbsp; <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 8: Man-in-the-Middle Attacks<\/h3>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/MitM-2-300x300.png\" alt=\"\" class=\"wp-image-11417\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/MitM-2-300x300.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/MitM-2.png 680w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Man-in-the-middle (MitM) attacks, or eavesdropping\nattacks as they\u2019re sometimes called, occur when an attacker inserts themselves\ninto two-party transactions. Imagine you\u2019re having a phone conversation with\nyour bank and an unwanted third party taps into your phone line and starts\nlistening to your private conversation, gaining access to your personal and\nfinancial information. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s the same concept with a MitM attack. These types of\ncyber security threats are made by cybercriminals who set up fake public Wi-Fi\nnetworks or install malware on victims\u2019 computer or networks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless of how they do it, the goal is the same: To\nget access to your business or customer data. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">An Example of a Real-World MitM Attack<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Banks and other financial institutions are popular\ntargets of man-in-the-middle attacks, as are banking mobile apps. However,\nhackers don\u2019t like to limit themselves and will attack companies and\norganizations across all industries, including government organizations. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.theguardian.com\/world\/2018\/oct\/04\/how-russian-spies-bungled-cyber-attack-on-weapons-watchdog?awc=11152_1565792642_37a088fde5cf4db498e6e2fbb8eb9df6&amp;utm_source=afl&amp;utm_medium=awin&amp;utm_content=IDG+Communications%2C+Inc.\">A notable\nrecent example<\/a> of a MitM attack occurred when a group of intelligence agents\nfrom Russia\u2019s GRU (the Main\nIntelligence Directorate of the General Staff of the Armed Forces of the Russian Federation) tried to hack into the office of the\nOrganisation for the Prohibition of Chemical Weapons (OPCW) at The Hague. They\nused a Wi-Fi spoofing device (a Wi-Fi panel antenna) to try to get information\nrelating to the results of an investigation. While the attack itself failed, it\nstill goes to show that no one \u2014 not even governments \u2014 are exempt from being MitM\nattack targets. <\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Although SSL\/TLS encryption protocols are not 100%\nperfect, they\u2019re still the best way to help protect your company, customers,\nand website from man-in-the-middle attacks. HTTPS for websites is not only\nrecommended but is actually required by major browsers such as Google Chrome,\nFirefox, etc. Without an SSL certificate to facilitate the handshake between\nyour client\u2019s browser and your web server, which protects in-transit data, your\nsite will be flagged as \u201cNot Secure\u201d and you\u2019ll lose traffic and business. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Another way to avoid MitM attacks is to instruct your\nemployees to avoid using public Wi-Fi connections whenever possible. Using <a href=\"https:\/\/vpnstore.com\/how-a-vpn-protects-you-on-public-wifi\/\">virtual\nprivate networks (VPNs) on public Wi-Fi<\/a> can help increase security by\ncreating secure, encrypted connections at times when using public networks are\nunavoidable.&nbsp;&nbsp; <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cyber Security Threat or Risk No. 9: Poor Digital Certificate Management<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Expired SSL certificates. Expired code signing\ncertificates. It doesn\u2019t sound like that big of an issue, so who cares, right? <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You should. A lot. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We\u2019ve talked about certificate expiries as a form of\ncyber <a href=\"https:\/\/www.thesslstore.com\/blog\/a-sneaky-online-security-threat-encrypted-malware-in-ssl\/\">security threat<\/a> before. But, if you\u2019re new to our little corner of the\ninternet, you may be surprised to hear just how dangerous and costly poor\npublic key infrastructure (PKI) practices can be for your business. In fact,\nthe average cost of unplanned certificate expirations is <strong>$11.1 million<\/strong>. No,\nthat\u2019s not a typo. The number is so high because <a href=\"https:\/\/www.thesslstore.com\/blog\/what-happens-when-your-ssl-certificate-expires\/\">expired\ncertificates<\/a> can result in a litany of issues, including website downtime\nand service outages for your business. <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"288\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2014\/02\/Certificate-Expiry-1024x288.png\" alt=\"Certificate expiration can be fatal, costing organizations millions of dollars every year\" class=\"wp-image-10106\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2014\/02\/Certificate-Expiry-1024x288.png 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2014\/02\/Certificate-Expiry-300x84.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2014\/02\/Certificate-Expiry-768x216.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2014\/02\/Certificate-Expiry.png 1564w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">All of these things can significantly <a href=\"https:\/\/www.thesslstore.com\/blog\/how-improving-your-cyber-security-posture-benefits-your-bottom-line\/\">impact\nyour bottom line<\/a> by: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Increasing downtime, <\/li><li>Reducing revenue, <\/li><li>Turning away prospective (and existing)\ncustomers, and <\/li><li>Making your organization noncompliant, which\nleads to noncompliance fines and potential lawsuits <\/li><\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">An Examples of What Happens When You Have Inadequate Certificate Management<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Certificate expiries can happen to any website or\nbusiness if they\u2019re not careful. It\u2019s happened to <a href=\"https:\/\/www.thesslstore.com\/blog\/linkedin-suffers-ssl-tls-certificate-expiration-again\/\">LinkedIn<\/a>\nmultiple times and also happened to dozens of <a href=\"https:\/\/www.thesslstore.com\/blog\/more-websites-breaking-as-certificates-expire-during-government-shutdown\/\">U.S.\ngovernment websites<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.thesslstore.com\/blog\/what-happens-when-your-ssl-certificate-expires\/\">Ericsson<\/a>,\nthe Swedish cellular company that manufacturers back-end equipment and\nmanagement software, is another example of a company that allowed a certificate\nto expire. As a result, tens of millions of cellular phone users in the U.K.\nand throughout Asia \u2014 those who cell service providers used Ericsson\u2019s\nmanagement software that had the expired certificate \u2014 experienced service\ndowntime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Learn from their examples: Don\u2019t let your SSL or other\nX.509 digital certificates expire. Period.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended Solution(s)<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019re still relying on Excel spreadsheets and other\nmanual methods of certificate management, saying you\u2019re behind the eight ball\nis an understatement. Managing a few SSL certificates and their corresponding\nkeys manually isn\u2019t too bad. But when you\u2019re doing it at scale for an\nenterprise \u2014 when you\u2019re managing hundreds, thousands, or even <em>hundreds of\nthousands<\/em> of certificates and key \u2014 there\u2019s it\u2019s virtually impossible to\nkeep up with them all.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where using a PKI certificate management tool can help. For example, <a href=\"https:\/\/www.thesslstore.com\/partner\/comodo-certificate-management.aspx\">Sectigo Certificate Manager<\/a> (formerly Comodo CA Certificate Manager) is a solution that helps you to mitigate certificate expiry issues by automating rapid certificate renewals, installations, and revocations. It\u2019s a single pane of glass that allows you to manage and monitor all of your certificates and keys, as well as delegate tasks and manage access and roles.&nbsp; <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>What other cyber security threats would you like to see included on the list? As always, share your thoughts in the comments below.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>2019\u2019s biggest cyber security threats are and what you can do to avoid them Like a sniper, the most dangerous cyber security threats are the ones you never see coming&#8230;.<\/p>\n","protected":false},"author":17,"featured_media":11423,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[11036,166],"class_list":["post-11415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-cyber-threats","tag-phishing","post-with-tags"],"views":145611,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/08\/Ruined-Day-Feature.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=11415"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11415\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/11423"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=11415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=11415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=11415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}